Threat LevelCRITICAL80/1001 rule type
3 incidents on record · active attack detected · last seen 1d ago · bulletproof hosting
| PTR | 45.78.23.131.16clouds.com |
| Org / ASN | IT7 Networks Inc |
| Country | 🇭🇰 Hong Kong |
| City | Hong Kong, Kowloon |
| Timezone | Asia/Hong_Kong |
Abuse-Tolerant HostingIT7 Networks Inc / 16clouds.com (AS25820)
IT7 Networks Inc (AS25820) operates approximately 425,000 IPv4 addresses across North America and Hong Kong under the 16clouds.com brand, with abuse contact routing to abuse@sioru.com. The network is tagged for BitTorrent, anonymizing proxy, and botnet infrastructure. A single IP in the 45.78.19.0/24 block generated over 4,000 block events against monitored infrastructure in a single day — the highest single-IP event rate in the observed dataset — consistent with dedicated, long-running attack VPS allocations rather than compromised consumer endpoints.
Attack Analysis
Port 22 Honeypot Probe
This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.
Reports (3)
| Date | Severity | Description |
|---|---|---|
| 3 Jun 2026 - 08:13 | medium | IDS: Port 22 honeypot probe |
| 3 Jun 2026 - 04:35 | medium | IDS: Port 22 honeypot probe |
| 3 Jun 2026 - 00:35 | medium | IDS: Port 22 honeypot probe |
EagleEye Intelligence